diff --git a/README.md b/README.md
index d499590..dfb35cb 100644
--- a/README.md
+++ b/README.md
@@ -3,8 +3,17 @@ SMTP to HTTP gateway
 
 Usage
 -----
-Begin listening for incoming messages over SMTP and post them to the
-specified HTTP endpoint.
+Begin listening for incoming messages over SMTP and post them to the sepcified
+HTTP endpoint.
 ```sh
 smtp2http https://dev-services.zingle.me/inbound-communication/email
 ```
+
+Enable TLS using separate certificate and key files with signing CA cert.
+```sh
+CERT=/etc/private/ssl/zingle.crt
+KEY=/etc/private/ssl/zingle.key
+CA=/etc/private/ssl/zingle-ca.crt
+smtp2http -T$CERT:$KEY:$CA https://dev-services.zingle.me/foo
+```
+
diff --git a/bin/smtp2http.js b/bin/smtp2http.js
index 437ec72..d8fce33 100644
--- a/bin/smtp2http.js
+++ b/bin/smtp2http.js
@@ -1,10 +1,48 @@
 var squabble = require("squabble").createParser(),
-    args;
+    smtp = require("smtp-protocol"),
+    http = require("request"),
+    readFile = require("fs").readFileSync,
+    args,
+    tlsTokens,
+    serverOpts = {};
 
 // setup CLI argument parsing
 squabble.shortOpts().longOpts().stopper()
+    .option("-T", "--tls")
     .required("ENDPOINT");
 
 // parse arguments
 args = squabble.parse();
+if (args.named["--tls"]) {
+    tlsTokens = args.named["--tls"].split(":");
+    switch (tlsTokens.length) {
+        case 1:
+            serverOpts.pfx = readFile(tlsTokens.shift());
+            break;
+        case 2:
+            serverOpts.cert = readFile(tlsTokens.shift());
+            serverOpts.key = readFile(tlsTokens.shift());
+            break;
+        case 3:
+            serverOpts.cert = readFile(tlsTokens.shift());
+            serverOpts.key = readFile(tlsTokens.shift());
+            serverOpts.ca = readFile(tlsTokens.shift());
+            break;
+        default:
+            throw new Error("unrecognized --tls argument");
+    }
+}
 
+// create and start SMTP server
+smtp.createServer(serverOpts, function(req) {
+    // accept all incoming messages
+    req.on("to", function(to, ack) {
+        ack.accept();
+    });
+
+    // send message to web endpoint
+    req.on("message", function(stream, ack) {
+        stream.pipe(process.stdout);
+        ack.accept();
+    });
+}).listen(process.env.NODE_PORT || 25);